Mac – Is the mac being hacked by a user called Guatoan? And how can I remove this user

hackingmacmalwareterminalvirus

I recently visited a website and on pressing a link another window automatically opened saying the website had found a virus on my laptop. Obviously this was a scam so I returned to the original website and tried the link again. This time the same thing happened so I closed the scam window and tried a third time. This time however the same scam page opened only an uncontrollable and loud beeping sound accompanied the warning and many files began to quickly and automatically download from the scam website and into my downloads folder on my dock. I was with a friend and she said that it looked like loads of circular coins were being downloaded. I immediately quit safari and permanently deleted the files that had downloaded from the scan website unfortunately without looking at what type of files they were. Then after searching online to find ways to identify and remove viruses and malware I downloaded Malwarebytes and Dr. Antivirus and did full scans where no threats were found. Then I wanted to see if my mac had been hacked by someone perhaps so i found advice on here:(https://www.techwalla.com/articles/how-to-find-out-if-your-computer-is-hacked) telling me to go into terminal and identify all the current users. All the users seem typical and normal except a user called "Guatoan" and I have no idea if this is normal or not and, if i am indeed hacked, if I can remove this user immediately? If anyone has had a similar experience or has any advice or knowledge regarding to anything I have said in this post that could help me understand better what is going on I would be extremely thankful! thank you very much

Best Answer

It’s not clear what user ID you are running - so to rule that out - what does this command show?

id

Next, you’ll want to inventory your backups to know if you can erase everything and or need to make a backup. Next you can inventory all the accounts - run this command

dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]'

This will fetch all the users with their respective directories.

Then you can delete the user using this. sudo is needed as the commands need to run as root.

sudo dscl . delete /Users/your user name(name from the output)
sudo rm -rf (dir from the output)

Only delete the dir if it is not one of the system ones - probably only do that if it is of for /Users/X where X is not one of your normal users.

Related Question